GIPA Guideline 3 - For local councils - personal information contained in development applications: What should not be put on council websites

The Information Commissioner is empowered under sections 12(3) and 14(3) of the Government Information (Public Access) Act 2009 (NSW) (the GIPA Act) to issue guidelines to assist agencies regarding the public interests in favour of, or against disclosure.

These guidelines, made pursuant to those sections of the GIPA Act, are made to assist local councils to determine the public interest considerations for and against publishing personal information associated with development applications (DAs) on councils’ websites. The obligation to publish DA information on council websites is contained in schedule 1(3) to the Government Information (Public Access) Regulation 2009 (NSW) (The GIPA Regulation).

These Guidelines have been developed following consultation with local councils, the Division of Local Government, and members of the public who responded to the IPC’s Consultation Paper 1: Development applications and personal information on websites – issues for local councils.

As this issue involves a privacy-related public interest, the Information Commissioner has also consulted with the Acting Privacy Commissioner in developing these guidelines, as required by section 14(4) of the GIPA Act.

The operation and effectiveness of the Guidelines will be reviewed after twelve months.

Deidre O’Donnell

Information Commissioner

31 May 2011

Overview

Local councils receive and hold a significant amount of personal information collected during the ordinary course of their functions.

A key example is the information required to be provided by applicants who lodge development applications (DAs), and by those who wish to comment on those applications.

The Government Information (Public Access) Act 2009 (NSW) (the GIPA Act) and the Regulation made under that Act (the GIPA Regulation) place requirements on local councils to publish the information they hold about DAs on their websites, and to make the information publicly available in other ways. For example, section 6 of the GIPA Act states that agencies must make certain information, known as open access information, publicly available on the agency’s website, and in any other form that the agency considers to be appropriate.

Section 18 of the GIPA Act contains a list of open access information, which is supplemented by the GIPA Regulation. Schedule 1 to the GIPA Regulation places additional open access obligations on local councils, requiring certain information to be made available on councils’ websites, and also for inspection and copying at council offices. Of relevance to these Guidelines, Schedule 1[3] to the GIPA Regulation requires local councils to disclose and publish on their websites information about DAs.

Requiring the publication of DA information on council websites facilitates greater accessibility to government information which affects people at local and community levels. This contributes to transparent decision-making and enables public participation in decisions that affect individuals and the community. However, documents associated with DAs are likely to contain a significant amount of personal information. Local councils are accordingly required to balance the disclosure requirements of the GIPA Act and the privacy provisions of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act).

Local councils concerned about whether, and how, to disclose personal information associated with DAs on their websites approached the OIC for guidance. The OIC released a consultation paper in November 2010 seeking responses from local councils about their current practices regarding online publishing of DA information, including personal information, and posed four options for how councils might approach this issue in the future. The paper also invited comment from members of the public about the adequacy and appropriateness of DA information on council websites: the type of information, if any that should not be published on council websites; and desirable procedures for consulting with people before councils publish their personal information.

Under sections 12(3) and 14(3) of the GIPA Act, the Information Commissioner may make guidelines to assist agencies regarding the public interest considerations in favour of, or against, disclosure of information. These Guidelines are made to assist local councils to determine the public interest considerations for and against publishing personal information associated with DAs on councils’ websites. The Acting Privacy Commissioner has been consulted in accordance with section 14(4) of the GIPA Act. Agencies are required to have regard to this guideline in accordance with section 15(b) of the GIPA Act.

Purpose of the Guidelines

These Guidelines are intended to provide assistance to local councils regarding the publication on their websites of personal information that is submitted to councils as part of the DA process. Accordingly, the Guidelines deal only with personal information, and only with the publication of that information on council websites.

The Guidelines do not deal with or affect disclosure of personal information by other means, nor do they deal with or affect other non-personal information associated with DAs that is required to be disclosed under the GIPA Regulation and the Environmental Planning and Assessment Act 1979 (NSW) (the EPA Act), or the Environmental Planning and Assessment Regulation 2000 (NSW) (the EPA Regulation).

In addition, these Guidelines do not deal with material that may be protected by copyright. Dealings by local councils with architectural plans and drawings that are protected by copyright and submitted with DA applications are the subject of separate knowledge updates published on the OIC website.

Part 1: Legislative disclosure requirements

1.1 Section 6 of the GIPA Act requires agencies to publish open access information on their website or via an alternative means free of charge. Agencies must publish open access information in the manner prescribed by the GIPA Act or Regulation unless there is an overriding public interest against disclosure (s 6(1)), or if it would involve an unreasonable cost to the agency (s 6(2)). Section 18 of the GIPA Act outlines the type of information that comprises an agency’s open access information. These categories of information may be supplemented by the Regulation. For local councils, DA information forms part of a council’s open access information pursuant to Schedule 1[3] to the GIPA Regulation. Schedule 1[3] provides as follows:

3(1) Information about development applications

(a) development applications (within the meaning of the Environmental Planning and Assessment Act 1979) and any associated documents received in relation to a proposed development including the following:

(i) home warranty insurance documents,

(ii) construction certificates,

(iii) occupation certificates,

(iv) structural certification documents,

(v) town planner reports,

(vi) submissions received on development applications,

(vii) heritage consultant reports,

(viii) tree inspection consultant reports,

(ix) acoustics consultant reports,

(x) land contamination consultant reports,

(b) records of decisions on development applications (including decisions made on appeal).

However, the following information is excluded under schedule 1(3)(2):

(a) the plans and specifications for any residential parts of a proposed building, other than plans that merely show its height and external configuration in relation to the site on which it is proposed to be erected; or

(b) commercial information, if the information would be likely to prejudice the commercial position of the person who supplied it or to reveal a trade secret.

1.2 Further, Schedule 1[2](c) to the Regulation requires councils to disclose the minutes of council meetings, which would include meetings at which planning decisions are made. A register of those decisions is required to be kept and be made public under section 375A of the Local Government Act 1993 (NSW).

1.3 The combined effect of section 6 of the GIPA Act and Schedule 1 to the GIPA Regulation is that local councils must publish information associated with DAs on their websites, as well as making it available for inspection and copying at council offices. These disclosure requirements are designed to ensure that people who are interested in, or potentially affected by, development applications can be made fully aware of the details of the proposed development and have the opportunity to comment. These requirements also promote open and accountable decision-making.

1.4 The disclosure requirements in the GIPA Act and GIPA Regulation are in addition to provisions in other legislation requiring the publishing of DA information. For example, the EPA Act and EPA Regulation require consent authorities (which will generally be local councils) to publish notices of DAs in local newspapers, exhibit notices on the property of the proposed development, and provide access to DAs and any accompanying information at council offices and in such other places as specified in the EPA Regulation.

1.5 The EPA Regulation requires that written notices of DAs include the following information:

a description (including the address) of the land on which the development is proposed to be carried out

the name of the applicant and of the consent authority

a description of the proposed development

a statement that the DA and the documents accompanying it are available for inspection at council offices, and an indication of how people may make submissions with regard to the DA, including time frames and appeal rights.

1.6 These Guidelines discuss the provisions of the EPA Act and EPA Regulation only to illustrate the type of information about DAs that must be made public under those laws. Neither the GIPA Act or GIPA Regulation, nor these Guidelines, affect the responsibilities of local councils under the EPA Act or the EPA Regulation.

1.7 In addition to information about the subject property, the information associated with DAs is likely to contain a significant amount of personal information. For example, information submitted, or generated in conjunction with, a DA might typically include:

names and addresses of the applicants, owners and people who lodge submissions

personal and business contact details

signatures of DA applicants and people making submissions

photos of property and people

financial details of the applicant

other personal information included to support an application, or to give weight to an objection.

1.8 Some of this information is required to be produced as part of the planning and assessment process. Other information, such as financial details and photos of people in their houses, is not mandatory, but may be submitted by applicants and those lodging objections to assist their cause. In some cases, personal information should be disclosed as it is integral for transparency and to understanding the DA decision-making process. However, in other cases, the information may be of such a personal or sensitive nature that, while still forming part of the DA file, it would be contrary to the public interest for such information to be disclosed on a website where theoretically it could be viewed by anyone in the world with access to the internet and downloaded into other formats.

1.9 Apart from the list of documents in Schedule 1[3], the GIPA Regulation is not specific about the type of information associated with DAs that must be published or otherwise disclosed. The GIPA Act states that there is a presumption that government information, including personal information about individuals held by government agencies, must be disclosed unless there is an overriding public interest against disclosure (see section 5). That presumption in favour of disclosure is more heavily weighted with regard to open access information, such as DA information, given the mandatory nature of its disclosure, and should only be displaced where there is an overriding public interest against disclosure (section 6).

1.10 Local councils are accordingly required to apply the public interest test when determining what information should be published on council websites. This requires councils to balance the disclosure requirements of the GIPA Act and Regulation (and similar requirements in other laws relevant to DAs), with any considerations against disclosing personal information. The public interest test can relate to disclosure of information per se, or to a method of disclosure.

Part 2: The public interest test: issues to consider

Considerations in favour of disclosure

2.1 Section 12 of the GIPA Act reiterates the general presumption in favour of disclosure of government information, and lists examples of public interest considerations that favour disclosure. Those considerations include situations where:

(a) Disclosure of the information could reasonably be expected to promote open discussion of public affairs, enhance Government accountability or contribute to positive and informed debate on issues of public importance.

(b) Disclosure of the information could reasonably be expected to inform the public about the operations of agencies and, in particular, their policies and practices for dealing with members of the public.

(c) Disclosure of the information could reasonably be expected to ensure effective oversight of the expenditure of public funds.

(d) The information is personal information of the person to whom it is to be disclosed

2.2 Disclosure of the information could reasonably be expected to reveal or substantiate that an agency (or a member of an agency) has engaged in misconduct or negligent, improper or unlawful conduct.2.2 Disclosure of DA information aims to promote public awareness about proposed developments. It enables interested or potentially affected parties to make submissions or to object to the proposed development. Public disclosure also ensures accountability and transparency of, and facilitates community participation in, government decision-making. These considerations, together with the fact that the GIPA Regulation makes it mandatory to disclose DA information, are factors that clearly support the public interest in favour of disclosure of such information.

2.3 Publishing some personal information on websites would clearly support the public interest in accountable and transparent decision-making. For example, publishing the name and address of the DA applicant, the address of the subject property and a description of the work to be done informs members of the public about the proposed development and enables them to voice an opinion. Also, publishing the outcome of the DA provides members of the public with information about the council’s decision-making process and the factors that influenced the decision.

Considerations against disclosure

2.4 An exhaustive list of public interest considerations against disclosure is contained in the Table in section 14 of the GIPA Act. Of relevance for these Guidelines, item 3 in the Table provides as follows:

There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects:

(a) reveal an individual’s personal information;

(b) contravene an information protection principle under the Privacy and Personal Information Protection Act 1998 or a Health Privacy Principle under the Health Records and Information Privacy Act 2002;

(c) prejudice any court proceedings by revealing matter prepared for the purposes of or in relation to current or future proceedings;

(d) prejudice the fair trial of any person, the impartial adjudication of any case or a person’s right to procedural fairness;

(e) reveal false or unsubstantiated allegations about a person that are defamatory;

(f) expose a person to a risk of harm or of serious harassment or serious intimidation; or

(g) in the case of the disclosure of personal information about a child—the disclosure of information that it would not be in the best interests of the child to have disclosed.

2.5 Personal information is defined in Schedule 4[4] to the GIPA Act as “information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual (whether living or dead) whose identity is apparent or can reasonably be ascertained from the information or opinion”. Personal information includes such things as an individual’s fingerprints, retina prints, body samples or genetic characteristics, but does not include:

(a) information about an individual who has been dead for more than 30 years;

(b) information about an individual (comprising the individual’s name and non-personal contact details) that reveals nothing more than the fact that the person was engaged in the exercise of public functions; or

(c) information about an individual that is prescribed by the regulations as not being personal information.

2.6 The Information Protection Principle dealing with disclosure of personal information is contained in section 18 of the PPIP Act and provides that agencies must not disclose personal information unless:

(a) the disclosure is directly related to the purpose for which the information was collected, and there is no reason to believe that the person would object to the disclosure, or

(b) the individual concerned is aware, or reasonably likely to be aware, that information of that kind is usually disclosed, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

2.7 Disclosure of personal information as a consideration against releasing information is discussed at paragraph 2.9 below.

Steps in applying the public interest test

2.8 When applying the public interest test with regard to disclosure of open access information as outlined in section 6(1) of the GIPA Act, local councils should take the following steps:

Identify relevant public interest considerations in favour of disclosure, taking into account the general presumption in section 5 of the GIPA Act in favour of disclosure of government information. Local councils may consider any public interest in favour of disclosure (s 12(2)).

Identify relevant public interest considerations against disclosure and determine if any apply to the particular circumstances. The public interest considerations against disclosure that agencies may consider are contained in section 14 of the GIPA Act and agencies may only take into account these public interest considerations.

Assess whether the public interest considerations against disclosure outweigh the public interest considerations in favour of disclosure, giving appropriate weight to each consideration. There is an overriding public interest against disclosure of government information only if relevant public interest considerations against disclosure outweigh the relevant public interest considerations in favour of disclosure (s 13).

Revealing personal information as a consideration against disclosure

2.9 The fact that information is personal to an individual is not an absolute barrier to its disclosure, but is a relevant factor that weighs against release. With regard to DAs, certain personal information should be released to give context to the decision being made, to promote transparency in decision-making, and to help identify potential conflicts of interest. For example, public disclosure of the name and address of the DA applicant would help to identify whether the decision-maker is likely to benefit from the decision.

2.10 Generally, councils should aim to disclose as much DA information, including personal information, as possible in order to assist members of the public to understand the decisions being made and the reasons for those decisions. Wherever possible, disclosure should be via the methods set out in the GIPA Act and Regulation, including council websites.

2.11 However, in disclosing personal information, particularly on a website, councils should keep in mind the purpose of the DA disclosure provisions. The provisions are designed to promote the transparency of council decision-making, and are not aimed at making people’s personal details transparent. In this regard, there is some information which the Information Commissioner considers should not be disclosed on a website (see Part 3 of these Guidelines).

2.12 In addition, councils should avoid disclosing material that is malicious or could possibly be defamatory. This will be particularly relevant with regard to submissions or objections made in relation to DA applications, where people sometimes take the opportunity to air neighbourhood disputes. While some of the information in DA submissions will be relevant to the ultimate decision made by a council on the DA application and should be reported and disclosed, material that is scurrilous, inflammatory or irrelevant will not be. In disclosing information in submissions, councils should have regard to the purpose of the disclosure provisions and the object of the GIPA Act in promoting transparent and accountable decision-making.

Breaching the PPIP Act as a consideration against disclosure

2.13 Contravention of an Information Protection Principle in the PPIP Act is a consideration against disclosure of government information listed in item 3 of the Table in section 14 of the GIPA Act.

2.14 In determining whether disclosure of personal information would contravene the PPIP Act, local councils should ask the following questions:

(a) Is the information being disclosed for the same purpose for which it was collected, or a purpose directly related?

(b) Has the person who is the subject of the information consented to the disclosure?

(c) Is the public aware that certain personal information provided during the DA process may be disclosed, and if so, the type of information and the method of disclosure?

2.15 If the answer to any of these questions is “yes”, in that the information is disclosed for the same purpose for which it was collected (or a similar one), the individual has consented to the disclosure, or the public is aware that specific personal information is publicly disclosed and how it is disclosed, it is unlikely that there would be a breach of the PPIP Act.

2.16 However, personal information can be released under the GIPA Act even if the PPIP Act is breached. This is made clear by section 5 of the PPIP Act, which provides that nothing in that Act serves to lessen the obligations agencies must exercise under the GIPA Act.

2.17 Nevertheless, councils should aim to avoid breaches of the PPIP Act when disclosing personal information. To ensure compliance with the PPIP Act, councils should take steps to notify people of the type of information submitted with DA applications and objection letters that will be made publicly available, and how that information will be disclosed.

Part 3: Personal information that should not be published on council websites

3.1 The Information Commissioner considers that local councils should endeavour to disclose as much DA information on their websites as possible, subject to the application of the public interest test.

3.2 However, having had regard to the public interest considerations for and against disclosure, the type of information that is, or is likely to be, submitted in conjunction with DA applications, and following consultation with the Acting Privacy Commissioner, the Information Commissioner is of the view that it is not in the public interest to disclose the following information on council websites:

personal contact details of an individual, including personal phone/mobile numbers and email addresses

signatures on DA applications or submissions or objection letters

personal financial information, eg credit card details

health and medical information

photos depicting people.

3.3 Placing such information on a website weakens the protection of individual privacy, and does not further the public interest in transparent government decision-making in relation to development applications about particular properties.

Why is disclosure on a website different?

3.4 Unlike information made available for public viewing or copying at council offices, or information printed in a local newspaper, information published on a website is open to the world. Information in documents on a website can be accessed by people 24 hours a day, and downloaded, copied, modified and republished in various formats different to the original. Once published and captured, the information can no longer be controlled.

3.5 While the advantages of the internet as a medium to disseminate government information to the public are enormous and significant, the risks of placing people’s personal information on a website should not be underestimated. For example, disclosure of signatures, financial information and photos, particularly in electronic form, provides opportunities for identity theft. Disclosure of personal contact details to an online audience makes it easier for harassment or intimidation to occur, particularly where people may object to a DA or resent comments made in an objections letter. Agencies therefore need to be cautious about the type of personal information they publish on their websites.

3.6 These Guidelines do not affect disclosure by other means, such as enabling view only access or providing copies of material in electronic or paper form, subject to the public interest test.